Unite by AI’s DroidClaw application contains a flaw in the claim Endpoint, specifically in the function within server/src/routes/pairing.ts, that fails to properly limit excessive authentication attempts. An attacker can repeatedly try to authenticate, potentially exhausting server resources or bypassing account protections. This weakness does not grant code execution but directly undermines account security and could enable credential stuffing or brute‑force attacks.

UnitedbyAI DroidClaw, versions up to 0.5.3. Any installation that has not yet updated to a newer major release is vulnerable.

The CVSS score of 6.3 places the vulnerability in the medium range, and the public exploit is reported as difficult to execute but still available for remote attackers. Because the exploit is not listed in the CISA KEV catalog and EPSS data is unavailable, the likelihood remains uncertain, yet the high complexity and remote nature of the attack suggest that mitigations should be applied promptly to reduce the risk of repeated authentication attempts.